From: enh <enh@google.com>
Subject: Re: setenv(3) segfaults when value == NULL
To: "Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@orthanc.ca>
Cc: tech@openbsd.org
Date: Fri, 13 Mar 2026 16:51:17 -0400

might be worth filing an austin group bug, since their ERRORS section
only mentions name:
https://pubs.opengroup.org/onlinepubs/9799919799/functions/setenv.html

(leaving it unclear just how an implementation can "copy" a null
string... that strlen() being the point at which all the
implementations i just checked currently crash :-) )

On Fri, Mar 13, 2026 at 4:45 PM Lyndon Nerenberg (VE7TFX/VE6BBM)
<lyndon@orthanc.ca> wrote:
>
> Calling setenv(3) as setenv("foo", NULL, 1) will SEGV.  This
> should return EINVAL as with setenv(NULL, "foo", 1).
>
> --lyndon
>
>
>
> --- setenv.c.orig       Fri Mar 13 13:19:06 2026
> +++ setenv.c    Fri Mar 13 13:20:21 2026
> @@ -95,7 +95,7 @@
>         const char *np;
>         int l_value, offset = 0;
>
> -       if (!name || !*name) {
> +       if (!name || !*name || !value) {
>                 errno = EINVAL;
>                 return (-1);
>         }
>
> --- getenv.3.orig       Fri Mar 13 13:32:01 2026
> +++ getenv.3    Fri Mar 13 13:32:08 2026
> @@ -128,6 +128,12 @@
>  character.
>  .Pp
>  The
> +.Fn setenv
> +function
> +.Ar value
> +was passed a NULL pointer.
> +.Pp
> +The
>  .Fn putenv
>  function was passed a
>  .Ar string
>